https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206415#M60081 <P>I'm assuming the answer below works fine but if not try the following:</P> <PRE><CODE>| where NOT LIKE(field,"%$") </CODE></PRE> Tue, 22 Dec 2015 08:32:40 GMT javiergn 2015-12-22T08:32:40Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206413#M60079 <P>Hello Everyone,</P> <P>Am hitting a snag and need some help. So I have an index whereby we have many account names returned to us from an index. Some of these account names end in the <CODE>$</CODE> character.</P> <P>I am trying to filter any events where the account name ends in <CODE>$</CODE> out of the result set. </P> <P>I have tried <CODE>search NOT account_name = "*$"</CODE> but this doesn't seem to work. I am guessing that <CODE>$</CODE> is a reserved character or something as this works fine when filtering out other stuff not ending in a special character.</P> <P>Anyone got any hints for me? I would really appreciate it. </P> Mon, 21 Dec 2015 14:35:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206413#M60079 Bytes 2015-12-21T14:35:21Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206414#M60080 <P>Have you tried using <CODE>NOT "*\$"</CODE>?</P> Mon, 21 Dec 2015 15:48:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206414#M60080 sundareshr 2015-12-21T15:48:51Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206415#M60081 <P>I'm assuming the answer below works fine but if not try the following:</P> <PRE><CODE>| where NOT LIKE(field,"%$") </CODE></PRE> Tue, 22 Dec 2015 08:32:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206415#M60081 javiergn 2015-12-22T08:32:40Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206416#M60082 <P>Hi All,</P> <P>Thanks for your responses. I found the problem. After exploring the events that Splunk was indexing I found that the account_name atribute had two values. One of the user who created the event (what I was after) and one of the AD machine account (ending $ that I was trying to filter out). Basically when I ran your (and my) search strings they were working but all acount_name atributes had a value ending $.</P> <P>As such, I explored and found another atribute that only has the user name (and no machine name). Performing both your functions on that worked well.</P> <P>Both your answers work to do what I asked though so thank you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 29 Sep 2020 08:16:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206416#M60082 Bytes 2020-09-29T08:16:27Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206417#M60083 <P>This should work:</P> <P>account_name != "*$"</P> Tue, 17 Jan 2017 21:50:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-search-results-where-a-field-value-ends-with/m-p/206417#M60083 weicai88 2017-01-17T21:50:20Z